CVE-2026-118636

Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder

State: Published
Severity: 9.8 Critical
Published: Oct 31, 2026
Updated: Oct 31, 2026
Reserved: Oct 28, 2026

Description

**UNSUPPORTED WHEN ASSIGNED**

JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE.

As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue.

Users are recommended to use the latest Apache MINA 2.2.X branch.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	apache

Weaknesses

CWE-502 Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder

Affected Products

Product	Versions
Apache MINAApache Software Foundation	3.0.0 through 3.0.0-M2Affected

References

https://www.cve.org/CVERecord?id=CVE-2026-118636third-party-advisory
https://lists.apache.org/thread.html/h76nwcrkvsffhsk2kq6cjzc6srtnty7xvendor-advisory
http://www.openwall.com/lists/oss-security/2026/10/31/3

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.